CVE-2024-1892 - CVE House
Back to Database
Status published High CVE-2024-1892

ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider

Vulnerability Description

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-1892

Credits & Attribution

No credits recorded in the NVD database.

References

More from scrapy

View All →
CVE-2025-6176
Brotli decompression bomb DoS in scrapy/scrapy
High 7.5
CVE-2024-3574
Authorization Header Leak During Cross-Domain Redirect in scrapy/scrapy
High 7.5
CVE-2024-3572
XML External Entity (XXE) Vulnerability in scrapy/scrapy
High 7.5
CVE-2024-1968
Authorization Header Leakage in scrapy/scrapy on Scheme Change Redirects
High 7.5
CVE-2022-0577
Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy
High 8.8

Affected Vendor

Affected Software

scrapy/scrapy
Vulnerable Versions:
unspecified

Timeline

Official Publish: February 28th, 2024
Last Modified: August 11th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-1333

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1496 Resource Hijacking
Impact
T1562 Impair Defenses
Defense Evasion
T1070 Indicator Removal on Host
Defense Evasion